Voting on Paper Ballots

Overview

The classic Australian of paper ballot provides an excellent introduction to
the system of checks and balances used to assure voter privacy and an accurate
vote count in the face of a variety of threats. In this system, first used
in the province of Victoria, Australia in 1858, voters are issued paper
ballots at a polling place, and after the ballot is marked, voters deposit
it in a ballot box.
After the polls close, the box is opened, the ballots are counted by the
election judges, and the totals are reported.

On the face of it, this system looks misleadingly simple, but the fact that
this system was first introduced in the mid 19th century and the fact that
it took decades before variations on this system to be adopted by other
jurisdictions is strong evidence that this was not a trivial invention!

The threats that must be accounted for in a paper ballot election include
ballot box stuffing and dishonest ballot counting. In addition, we must
guard the privacy of the voter, so that voters are not subject to harassment
(or worse) because of the way they cast their vote.

An analysis of the problem of carrying out an honest election begins with an
enumeration of the different parties in the process. For each party, we
identify of the threats that party poses and the countermeasures we can take
to meet these threats. Historically, the identification of threats has
frequently developed very slowly, with each threat being clearly addressed
only after serious improprieties have been widely publicized. Many paper
ballot voting systems in use today fail to address several threats, and
even in the realm of paper ballots, technological changes threaten some of
the countermeasures that have traditionally proven to be effective.

The rules given here governing the conduct of an election are not
intended to represent the rules used in any particular jurisdiction, but
rather, these rules are but one example of a reasonable refinement of the
Australian ballot.

The Parties

The primary parties that interest us are the voter and the election judges,
but we are also interested in several others. One important party is the
outsider who tries to buy votes. Another is the agency that prints the
ballots, and finally, we are concerned with assuring the security of ballot
transportation and storage.

The Voter

The first party we care about in any election system is the voter! Nobody
should be allowed to vote who is not entitled to vote, and nobody should
be allowed to vote more than once.

Traditionally, these two requirements have been enforced by maintaining a
voter registration list at the polling place and checking off each voter
on the list as they vote. One of the primary responsibilities of the
election judges at the polling place is to handle this job.

There is a tradeoff between a rigorous test of voter identity,
on the one hand, and a voting system where polling places are
pleasant, open and inviting to voter participation. A rigorous
test of voter identity could well prove sufficiently inconvenient
or even humiliating that legitimate voters refuse to participate!
On the other extreme, if voter identity is subject to no
verification, we have no reason to believe that the election results
reflect the will of the electorate.

It is probable that a system relying on imperfect tests of voter
identity in order to maintain a pleasant atmosphere at the polling
place will most accurately reflect the will of the electorate even
though it tolerates a modest level of fraud. This will be true when
the increase in legitimate turnout resulting from relaxed identity
checking more than offsets the resulting increase in fraud.

Many jurisdictions do not require the voter to present any form
of ID card. This may seem dangerously open to voter fraud, but there
are remarkably simple countermeasures that offer what we usually
consider to be adequate security. For example, if we selectively hire
election judges from within the precinct, there will be a high
probability that one or more judges will actually know many of the
voters, making more formal identity checks unnecessary.

When the voter requests a ballot, we typically require that the voters
name and address be announced so it can easily be heard by all present.
If a person tries to impersonate a legitimate voter or claim residence
at some address, there is a real risk that some other voter, perhaps
a neighbor, will notice! Asking voters to sign a form certifying that
they are indeed legitimate voters in the precinct, we gain additional
security by forcing a voter intent on fraud to commit the added
crime of forgery in front of a large number of witnesses.

If we assure that each voter is only allowed one trip to the voting booth
and ballot box, we still have not prevented the voter from casting multiple
ballots! A voter could, in theory, smuggle a stack of ballots into a polling
place and stuff the lot in the ballot box! This threat is met by two
countermeasures:

We require that the ballot box be out in the open, in clear view of all of
the election judges and of other waiting voters, so that any attempt to
stuff the ballot box would be difficult to conceal.

Second, we institute a system of strict accounting
for all ballots issued and voted, and we print ballots in such a way that
they are at least modestly difficult to counterfeit.

The accounting for ballots typically involves reconciling the number of ballots
found in the ballot box at the end of the election with the number issued to
voters during the voting period and the number stocked at the polling place
at the beginning of the election. At the end of the day, all ballots must
be accounted for as either voted, spoiled or never issued.

An interesting conflict arises between the problems of accounting
for ballots and the problem of allowing voters to cast secret
ballots. A classic accounting method involves attaching serial
numbers to each ballot and recording these numbers whenever ballots
are distributed or handled.

In order to allow secrecy, ballot forms that include serial numbers
are typically prepared with a perforation between the main ballot
and the tear-off tab where the number is printed. Typically, this
tab is torn off by the election judge at the time the ballot is given
to the voter, and at the close of polls, the number of torn tabs must
equal the number of ballots cast or spoiled.

The Outsider Trying to Buy Votes

We must protect voters from outsiders who might try to punish those who
vote "the wrong way" or reward those who vote "the right way". To protect
voters from punishment, we must assure the voter that his vote is secret.
To protect the public from voters willing to sell their votes, we must
be assured that even the voters themselves cannot prove how they voted
in order to claim a reward.

Ballot secrecy requires that the ballot contain no marks that could be
used to identify the voter. Neither preprinted information such as a serial
number nor any kind of personal identification such as a signature can be
allowed on the ballot. When it comes time to count the ballots, the election
judges must reject any ballot containing such information.

Additionally, because both the deposit of ballots in the ballot box and the
counting of ballots are done openly, we must defend against an observer
who notes the the order in which people cast ballots, and then, later, notes
the the votes in the order that they are counted. Voter privacy will be
compromised if these two processes are related!

We therefore require that the votes not be counted in the order they were
deposited! Ballot boxes should not be designed so that the ballots stack
neatly and in the order they were deposited, and when the ballot box is
opened for counting, its contents should be dumped into a disorderly pile
on the counting table and not handled in neat stacks that preserve their order.

An interesting approach to buying votes involves offering voters pre-voted
ballots, along with the promise to buy a blank ballot from any voter who
returns from the polls with one. While the voters are in the privacy of
the voting booth, they are guaranteed to have ample opportunity to exchange
their pre-voted ballot they smuggled into the polls for the blank ballot
that was given to them by the election judges.

This scheme requires only one blank ballot to start with. After this is marked
and deposited by the first voter, the perpetrator buys a blank ballot from that
voter, marks it, and gives it to a second voter. Thus, a single blank ballot
may be used to buy a large number of votes during the course of an election
day.

This is an example of a vote fraud scheme that only works in the presence
of partial security measures. If blank ballots are freely available, the
perpetrator has no way of knowing how the voter got a blank ballot. If blank
ballots are impossible to get, there is no way to get the single blank ballot
needed at the start of the day to begin the scheme. If there is no polling
place security, the perpetrator would have no need to pay voters to vote,
while if every voter was searched on the way in and out, smuggling pre-voted
ballots in and blank ballots out would be impossible.

Clearly, we cannot impose intimidating searches on voters; too many would
be driven away, so we must concentrate on preventing blank ballots from
reaching those intent on committing large-scale vote fraud.
We typically do this by using ballots that are difficult to forge combined
with strict accounting for all ballots printed.

Of course, few ballots are printed with the kind of anti-forgery
measures that are involved in the printing of, for example, paper
money; nonetheless, use of special cardstock and the distinctive
print quality of letterpress printing have traditionally been judged
to provided sufficient security.

The Election Judges

The election judges run the polling place and, in a precinct count system,
they count the ballots. If the election judges are dishonest, they can
fix the election any way they want, for example, by excluding registered
voters, allowing non-registered voters to vote, stuffing the ballot box
with extra ballots, discarding ballots that vote against the position they
support, or simply reporting vote totals that are fictional.

We use several tools in order to guard against such fraud. Of these, the
most important is openness.
At no time during the conduct of the election are the judges allowed
to take any action in private. For example:

As each voter is checked against the list of registered voters, the
election judge is required to call the name out, loudly enough that all
present can hear.

This allows others present, for example, election observers, to
record the names of those who voted and compare the names with lists of
eligible voters, and it gives a chance for those who may know the
voter by name to recognize that an impostor is attempting to vote.

To prove that the ballot box is empty before the polls are opened, the
election judges open the box and display its empty interior prior to the
opening of the polls, and then close and seal it.

For the full time between the public proof that the ballot box is empty
and the time the box is opened for ballot counting, the box remains sealed,
and in addition, it remains either in public view or in secure storage and
transport; it is never in the private custody of any one person or party.

When the polls close, ballot counting must be equally open. We cannot trust
an election in which we allow the ballot counting to be carried out
in private, behind locked doors.

We therefore require that all ballot counting
be done openly, from the time the ballot box is opened and its contents dumped
out for counting until the time the official totals for the precinct are
publically posted.

In order to account for all ballots printed, the count must include a
the number of ballots remaining unvoted, the number of ballots spoiled
by voters and replaced at the polling place, the number of spoiled ballots
found in the ballot box, and the number of valid ballots actually counted.

Additional auditing of the counting process is possible if, for each race,
in addition to counting the number of votes for each candidate,
the number of overvotes and undervotes is also counted. Undervotes occur
when voters fails to cast votes in a race, while overvotes occur when
voters mark more than the permitted number of alternatives. In simple races,
the sum of overvotes, undervotes and votes cast should add up to
the number of ballots deposited in the ballot box. Slightly more complex
accounting allows a similar check on races where voters may vote for more
than one candidate.

The requirement for open election administration may be met by
literally inviting the public, but when this leads to crowding that
threatens to interfere with the election, we must back away and
limit attendance to representatives of the public.

As an example, it is common for political parties
and campaign organizations to assign volunteers to monitor polling
places, noting the names of those who have voted. In addition to
supporting partisan "get out the vote" drives, these observers
serve as representatives of their organizations to monitor the
conduct of the election judges.

When the ballot boxes for a multiple-precinct jurisdiction are
checked and sealed at a central location before being
distributed to the polling places, and when full ballot boxes
are taken to a central location for counting, we typically achieve
a degree of openness by allowing each political party or campaign
organization to send a limited number of representatives as observers.

The selection criteria used for designating the election judges who will
administer the polling paces, set up the ballot boxes and count the votes
provide an additional check. If we allowed one party to control the makeup
of these panels that run each polling place, we would open the process to
fraud. Therefore, an open election system must prevent this.

We typically require that, to the extent possible, the judges for each
precinct be residents of that precinct. This ensures that many of the
judges will recognize many of the voters.

In addition, we require that,
to the extent possible, members of opposing factions or political parties
be represented in the panel of judges for each precinct.

It is frequently impossible to meet both requirements; some precincts
may have an insufficient number of qualified people able to work on
election day, while others my be so dominated by one or another party or
campaign organization that balance cannot be achieved.

Therefore, we typically provide a mechanism whereby parties and campaign
organizations can suggest judge candidates for each precinct, and the
list of judges appointed is made public prior to the election, so that,
if qualified people are overlooked or the panels are stacked in favor
of one party or campaign organization, a court challenge is possible.

In the United States, with our longstanding of two-party
political tradition, election laws frequently mandate
openness by requiring that members of both major parties
be included on the panel of election judges, or that
representatives of both major parties be invited to be
present as observers during ballot box inspection and ballot
counting.

Clearly, such wording is not acceptable. In the first place,
in some jurisdictions, there are significant third parties
that ought to be allowed representation. In some elections,
there are nonpartisan races that may be supported by campaign
organizations that should be allowed representation, and in jurisdictions
dominated by a single party machine, opposing factions within
that party ought to be allowed representation, particularly in primary
elections.

Therefore, to the extent possible, we should not talk about
representatives of the two major parties, but rather,
representatives of each party or campaign organization.

Voters can inspect their ballots to see if they have been pre-marked, but
such checking can be quite tedious, particularly if the ballot includes large
numbers of issues that most voters would rather ignore.
In addition, after the ballot is deposited in the ballot box, we must
assure voters that no additional marks are added! Therefore, nobody but
the voter must be in a position where they might be tempted to add marks to
a ballot!

To meet this requirement, we forbid those who handle ballots
from doing so within reach of pencils, pens or other marking devices!
Election judges who distribute ballots or interpret ballots must be clearly
distinguished from those who mark off voter names on the list of eligible
voters or who make tally marks as the votes are counted.

Furthermore, election judges themselves could attempt to buy votes by asking
voters to mark their ballots in a distinctive way in order to identify
themselves to the judge actually reading that ballot.

To prevent this, we ask the judges to reject all ballots containing any
stray marks; that is, any marks that might serve any purpose other than
indicating an anonymous vote for a candidate.

The rejection of ballots containing stray marks imposes a very
strict standard on the prohibition against ballot handlers having
any marking implements on them. If dishonest ballot handlers are
able to mark ballots, on seeing ballots containing votes for the wrong
candidates, they could invalidate them by making random marks.

Taking this to an extreme, dishonest ballot handlers have been known to
carefully park fragments of pencil lead under their fingernails,
allowing them to mark a ballot by casually dragging a fingertip
across it. To counter this, election officials in some jurisdictions
have been known to require careful inspection, trimming and cleaning
of fingernails prior to any ballot handling.

The combination of the openness requirement and this requirement sets the
minimum effective size for the panel of election judges, both at precincts
and in vote counting centers.

We need at least two judges, preferably from opposing factions, who
actually handle the ballots, distributing them to voters or inspecting them
and calling out their interpretation of each vote.
Independently from them, we need at least two judges, again, preferably from
opposing factions, to mark off names in the lists of eligible voters and to
maintain the tally sheets during counting. If there is a dispute or confusion,
we need an odd number of judges to break ties, so we need at least five judges
on the panel.

In any case, in any multi-precinct election,
after the results for one precinct have been computed, they must be accurately
incorporated into the totals for the election district. This necessarily
involves communication from precinct to regional to state offices, where
successive subtotals are computed, and with each step, errors are possible,
whether deliberate or accidental.

As soon as the judges counting the votes for a precinct arrive
at a count that is consistent, that is, a count that properly accounts for
all ballots cast and where the sums for each candidate are consistent with
the numbers of ballots cast, the results must be publically
posted.

This allows observers to reconcile the numbers with their own observations
of the counting, and it permits observers to check the official district-wide
totals by independently computing them.

No requirement for openness or public posting of results is of any use
unless there is some way to challenge an incorrect result and request that
the ballots be re-counted. It is conceivable that an informal demand for
a recount could be handled on the spot, but if this were done, it would
be possible for an observer to arbitrarily delay the completion of the
canvass of an election by repeated informal requests for recounts.

Therefore, there must be a formal mechanism for requesting a recount;
outside this formal mechanism, no recounting should be done once an official
total has been posted.

If we allow a recount request at any time, it would be possible for someone
to overturn a close election at any time, possibly long after someone has
begun serving in office. In the event of a close election, lingering doubts
about the outcome could paralyze the government.

Therefore, we impose a deadline on the right to request a recount.
This deadline must be long enough after the election to allow any questions
about the propriety of the process or correctness of the results to be
raised, and it must be before the term of office begins for the winner of
the election. After this deadline, the election is declared final and no
further challenge is allowed.

During the interval between the announcement of the official totals and
the end of the period during which recounts are allowed, we must store all
ballots for possible re-counting.

Therefore, after counting, all ballots and all records from the polling
place must be placed in secure storage, under lock and seal. Not only the
ballots that were counted, but also spoiled ballots and ballots rejected
during counting should be saved. Not only the lists of voters who voted
must be saved, but also all ballot stubs, so that every ballot issued can
be accounted for.

At the end of the recount period, the stored ballots are typically
destroyed, thus making any attempt to initiate a recount outside the recount
period moot.

This final requirement does not mean that the candidate may not be impeached,
subject to recall, or otherwise removed from office, but rather, it removes
such a removal from the domain of election law.

Rules Governing Ballot Interpretation

The election judges are constrained by the laws and administrative rules
imposed by the government. In the this presentation, a number of suggested
regulations are presented, but these are general procedural rules. The one
area where these rules are the least obvious and the most critical to the
outcome of the election where the rules govern the admissibility of ballots
and of individual votes on ballots.

One approach to this problem is to simply leave ballot interpretation to the
election judges. This approach is sometimes classified as the "clear and
obvious interpretation rule." Here, we give the election judges the
authority to interpret, as a vote, any mark on a ballot which indicates
the clear and obvious intent of a voter to cast a vote for one or the other
candidate.

The most obvious problem with this is that it seems to give the judges a huge
amount of leeway as to what marks they interpret as votes, but by requiring
that election judges work in pairs, where each pair contains representatives
of opposing parties, and by requiring that observers be allowed to closely
observe each pair of judges, clearly biased judgements will be very difficult
to hide.

A less obvious problem with this is that it allows voters to "sign" their
ballots by use of a distinctive marking method. A voter could vote by
initialing the box where a mark is intended, or a voter could record a
binary code using Xs and check marks to represent ones and zeros, with one
bit of data per office on the ballot (a long judicial retention ballot would
allow for thousands of distinct codes!).

To prevent encoding of voter identity on a ballot, we typically
require that votes be indicated by some kind of standardized mark, for
example, an X within a box of standard dimensions provided beside each
candidate name or yes/no alternative.

This standard is far stricter than the prohibition of stray marks on the
ballot that was suggested in the previous section. It can be imposed in
such a strict way that it becomes an effective tool for conducting a very
crooked election!

Consider a political machine or other entrenched group desiring to preserve
its power in the face of significant objections from the electorate.
One way to do this is to craft voting laws in such a way that election
judges have significant discretion as to which marks are acceptable as votes
and which can be disregarded or used to disqualify an entire ballot.

Of course, if the two opposing judges are equally able to disqualify ballots,
this poses little threat, but if the machine can control who is hired as an
election judge, a natural thing to do is to hire carefully trained judges
to work on behalf of the machine's party, while selecting relatively
inexperienced and untrained judges as representatives of the opposition.
Of course, if the opposition has the resources, they may provide training
to their judges, but in the traditional machine-run metropolitan area, this
has been a difficult venture.

A classical approach to enabling this kind of election manipulation has
been to enact complex laws (or administrative rules) governing the acceptable
forms of marks. For example, imagine a marking rule that specified that
the mark shall be in the form of an X made of straight lines connecting
opposite corners of the box beside the candidates name, with no part of
the X protruding outside the box -- such a protrusion being considered
a stray mark). A careful draftsman with a good eye may be able to make such
a mark, but most voters will only approximate it. Even so, fair-minded
judges are likely to ignore the fine details and accept minor deviations
from this standard until they learn how strict the machine's representatives
are about the slightest defects in marks for opposition candidates. By
that time, a sufficient number of votes may well have been counted to
determine the election!

The classical symptom of such manipulation is an unusually high percentage
of votes (or ballots) being excluded for improper marking. The 1910
Encyclopedea Brittanica article on Voting Machines mentions some
elections in which such rules apparently led to the exclusion of as many
as 40% of the ballots cast in some elections, with exclusions being as
likely in well educated upper class precincts as they were in precincts with
large numbers of poor and illiterate people!

One way to prevent such absurd criteria is to enumerate the acceptable types
of marks, but in Coulehan v. White, a case before the Maryland Supreme
Court cited in the Encyclopedea Brittanica article on Voting Machines,
27 different styles of X were enumerated. Requiring that election judges
be prepared to classify marks into such a complex scheme almost guarantees
that an entrenched machine will be able to prevale over a weak opposition
by ensuring that the machine's judges are better trained than those
representing the opposition.

To defend against this kind of legal attack on the machinery of the election
system, we may institute a mechanism such as the following:

If one election judge believes that a ballot contains a clear and
obvious indication of intent and the opposing judge with whom that judge
is paired believes that the ballot should be excluded because of an improper
mark, because of an overvote, or because of an undervote, the ballot should
be set aside for possible arbitration, in an envelope on the outside of which
is noted which vote (or votes) were subject to dispute and which judges
were in dispute. The procedural difficulty this imposes will generally
discourage election judges from disqualifying large numbers of votes!

The official canvass must indicate not only the number of votes cast
for each candidate, but also the number of votes on behalf of each candidate
excluded from the count because of disagreements between the election judges
over whether a mark is or is not acceptable. It is natural and
straightforward to include the count of overvotes and undervotes in the
canvass. Reporting everything guarantees that any unfair practices
during the vote count will be apparent in the final figures.

If the margin between the two leading candidates in an election exceeds
the number of disputed votes set aside on behalf of the second-place
candidate, those ballots must be reexamined. In extreme cases, such a
reexamination might be done by a jury in court, but it would seem
prudent to do this only in extreme cases. Normally, it is reasonable
to hope that the difficulty would be resolved by a different team of two
election judges (representing opposing parties) or perhaps by majority
vote in a team of four (no two from the same party).

Ballot and Ballot Box Transportation

When ballot boxes are sealed prior to an election at a central location,
and when ballots are counted centrally after the polls close, when
ballots are moved to storage awaiting a request for recount, and when ballots
are moved from storage to the site of the recount, it is essential
that tampering be prevented.

Open transport of ballot boxes might be possible, for example, if all ballots
were moved in a bus along with a crowd of observers, but generally, the
cost of such a scheme outweighs any benefit. In fact, if a crowd is allowed
during transport, the turmoil of a moving crowd could create new opportunities
for fraud.

Therefore, we typically require that all transport of ballots or ballot
boxes be in the custody of at least two election judges, representing
opposing political parties or campaigns, and that the judges travel together,
in the same vehicle, with the ballot box either in plain sight of all,
for example, on the seat between them, or with the ballot box locked away
where nobody may touch it, for example, in a locked trunk or locked in the
rear of a van.

The requirements for ballot transfer are comparable in some
ways to the requirements for transfer of evidence in a criminal
case. Just as we are very concerned with the chain of custody
for evidence, from the policeman who observed it on the ground
to the detective who put it in a bag to the evidence storage
locker where it was saved prior to the trial, and finally to the
person who delivered it to the courtroom, we are equally concerned
with the chain of custody for ballots.

In fact, the ballots are potential evidence in a criminal trial!
In the event that there is any allegation of tampering with
the election, the ballots become the central evidence about which the
trial revolves, and all of the steps in ballot processing
become steps in the chain of custody. This chain of custody must be
documented.

At each stage in ballot processing, a written record must be maintained
indicating who did what with the ballots. Who distributed them to voters,
who sealed transported the ballot box, who transported the ballot box, who
counted the ballots, and who saw to the locking and unlocking of the secure
ballot storage area. Each entry to this record is typically signed, witnessed
and dated; where possible, between signers and witnesses, opposing parties
and interest groups should be represented!

Ballot Storage

Secure ballot storage is essential, both between the time ballots are printed
and the time the polling place opens, and between the time the votes are
counted and the end of the recall interval. It is not enough that they be
stored under lock and key, since this requires that we extend unlimited trust
to all who have access to the key. Furthermore, all locks are vulnerable to
lockpicks!

Therefore, we typically require that secure ballot storage be in an area
that has multiple high-quality locks, each with a different key, and we
require that the keys for these locks be in the custody of different officials,
preferably representing opposing factions.

We typically require that locked entrance to the secure ballot storage
area be visible to the public and in an area that is regularly patroled by
security personnel.

We typically require that locked entrance to the secure ballot storage
area be clearly marked with easily visible and difficult to obscure warnings
requiring that witnesses be present whenever the door is open and whenever
the locks are manipulated in any way.